false positive owasp:api3:2019-define-error-responses-401 and others in schema with responses property

[DavidBiesack]

If an OpenAPI document has a schema with a responses property, this ruleset appears to treat it as
an operation responses object and applies several oawap responses rules to it, yielding a false positive error.

Note that both the responses property in the schema and the responses value in the example trigger the same false positive errors.

Context

Using attached source as spectral.yaml and run spectral:

spectral.yaml

(Note: the attachment has a .txt extension because GitHub does not allow .yaml files)

This yields false positives (see below).

Current Behavior

False positives. See Steps below

Expected Behavior

No error for an example with a responses object

Steps to Reproduce

# cat > owasp.yaml
extends: ['spectral:oas', '@stoplight/spectral-owasp-ruleset']
^D
$ spectral lint -r owasp.yaml spectral.yaml
 54:19      warning  owasp:api3:2019-define-error-responses-401  Operation is missing responses[401].                                    components.schemas.falsePositive.properties.responses
 54:19      warning  owasp:api3:2019-define-error-responses-401  Operation is missing responses[401].content.                            components.schemas.falsePositive.properties.responses
 54:19      warning  owasp:api3:2019-define-error-responses-500  Operation is missing responses[500].                                    components.schemas.falsePositive.properties.responses
 54:19      warning  owasp:api3:2019-define-error-responses-500  Operation is missing responses[500].content.                            components.schemas.falsePositive.properties.responses
 54:19      warning  owasp:api3:2019-define-error-validation     Missing error validation response of either 400 or 422.                 components.schemas.falsePositive.properties.responses
 54:19      warning  owasp:api4:2019-rate-limit-responses-429    Operation is missing rate limiting response in responses[429].          components.schemas.falsePositive.properties.responses
 54:19      warning  owasp:api4:2019-rate-limit-responses-429    Operation is missing rate limiting response in responses[429].content.  components.schemas.falsePositive.properties.responses
 61:24        error  owasp:api4:2019-string-restricted           Schema of type string must specify a format or pattern.                 components.schemas.falsePositive.properties.responses.items.properties.response
 67:19      warning  owasp:api3:2019-define-error-responses-401  Operation is missing responses[401].                                    components.schemas.falsePositive.example.responses
 67:19      warning  owasp:api3:2019-define-error-responses-401  Operation is missing responses[401].content.                            components.schemas.falsePositive.example.responses
 67:19      warning  owasp:api3:2019-define-error-responses-500  Operation is missing responses[500].                                    components.schemas.falsePositive.example.responses
 67:19      warning  owasp:api3:2019-define-error-responses-500  Operation is missing responses[500].content.                            components.schemas.falsePositive.example.responses
 67:19      warning  owasp:api3:2019-define-error-validation     Missing error validation response of either 400 or 422.                 components.schemas.falsePositive.example.responses
 67:19      warning  owasp:api4:2019-rate-limit-responses-429    Operation is missing rate limiting response in responses[429].          components.schemas.falsePositive.example.responses
 67:19      warning  owasp:api4:2019-rate-limit-responses-429    Operation is missing rate limiting response in responses[429].content.  components.schemas.falsePositive.example.responses

✖ 23 problems (4 errors, 18 warnings, 1 info, 0 hints)

Environment

macOS, node 14
Running in an npm package where we've installed:

    "@stoplight/spectral-cli": "^6.6.0",
    "@stoplight/spectral-owasp-ruleset": "^1.4.0",